4 ms·

I've been a Linode customer since the start of 2007 and my biggest worry right now is this... > Credit card numbers in our database are stored in encrypted for

I've been a Linode customer since the start of 2007 and my biggest worry right now is this... > Credit card numbers in our database are stored in encrypted format, using public and private key encryption. The private key is itself encrypted with passphrase encryption and the complex passphrase is not stored electronically. By not providing further clarification that the private key was stored outside that compromised host in that update, you can read between the lines that they are trying hard not to address that particular issue. I really don't want to assume that the attacker can now brute force the private key's passphrase, and it might not take long if that "complex" passphrase was a word out of /usr/share/dict/words. Or worse, that the billing process was monitored via the compromised network, RAM, or a key logger - to get the unencrypted private key or it's passphrase.

rellik 14y ago
Why won't they just tell us the private key's passphrase, so we can judge for ourselves how secure it is?
- eco 14y ago
  Once they give the private key passphrase out there would be no need for us to judge for ourselves. The hackers would have everyones credit card information at that point.
  - mike-cardwell 14y ago
    He was joking
plusbryan 14y ago
I'd recommend reporting your card likely stolen and getting a new number. The slight inconvenience is worth the peace of mind.
- bradleyland 14y ago
  I recommend not bothering. Liability for fraudulent CC activity (in the US) is very low (max $500), and banks never enforce the liability for two reasons: 1) it's easier for them to chargeback the transaction to the vendor, thus they're not out of pocket, and 2) it causes customers to leave for a provider that doesn't hold them liable. How much of your time spent chasing down and changing a CC number is worth a maximal risk of $500 with a vero low probability of occurring? EDIT: Thanks to nenolod for the correction!
  - nenolod 14y ago
    Since Dodd-Frank, debit cards and credit cards have the same liability protections.
  - justin66 14y ago
    > maximal risk of $500 I'm pretty sure you're off by a factor of ten. If someone makes fraudulent charges with your credit card, your maximum liability is $50, and you'll only have to pay that if the charges occur after you've reported the card stolen. (There are different rules for debit cards, that doesn't apply here.)

rellik 14y ago

Why won't they just tell us the private key's passphrase, so we can judge for ourselves how secure it is?

eco 14y ago
Once they give the private key passphrase out there would be no need for us to judge for ourselves. The hackers would have everyones credit card information at that point.
- mike-cardwell 14y ago
  He was joking

plusbryan 14y ago

I'd recommend reporting your card likely stolen and getting a new number. The slight inconvenience is worth the peace of mind.

bradleyland 14y ago
I recommend not bothering. Liability for fraudulent CC activity (in the US) is very low (max $500), and banks never enforce the liability for two reasons: 1) it's easier for them to chargeback the transaction to the vendor, thus they're not out of pocket, and 2) it causes customers to leave for a provider that doesn't hold them liable. How much of your time spent chasing down and changing a CC number is worth a maximal risk of $500 with a vero low probability of occurring? EDIT: Thanks to nenolod for the correction!
- nenolod 14y ago
  Since Dodd-Frank, debit cards and credit cards have the same liability protections.
- justin66 14y ago
  > maximal risk of $500 I'm pretty sure you're off by a factor of ten. If someone makes fraudulent charges with your credit card, your maximum liability is $50, and you'll only have to pay that if the charges occur after you've reported the card stolen. (There are different rules for debit cards, that doesn't apply here.)